Bump mtdowling/jmespath.php from 2.8.0 to 2.9.2 in /backend

[dependabot]

Bumps mtdowling/jmespath.php from 2.8.0 to 2.9.2.

Release notes

Sourced from mtdowling/jmespath.php's releases.

2.9.2

• Pass explicit trim characters ahead of the PHP 8.6 trim default change.

2.9.1

• Fixed the compiled runtime to emit function names as string literals, preventing arbitrary code execution.
• Fixed the parser to reject non-identifier function callees, such as literal and raw string callees.

2.9.0

• Added PHP 8.5 support.
• Fixed to_number() to parse number strings using the JSON number grammar.
• Fixed reverse() and string slicing to operate on UTF-8 characters rather than bytes.
• Fixed slicing of array-like (ArrayAccess + Countable) values.
• Fixed equality and contains() to use JSON semantics, e.g. 1 == 1.0 is now true.
• Fixed multi-select hashes to end projections, so following tokens apply to the projected list.
• Fixed sort() and sort_by() to compare numbers numerically.
• Changed sort(), sort_by(), max(), min(), max_by() and min_by() to order strings by code point.
• Fixed max_by() and min_by() to error on mixed-type keys instead of returning arbitrary elements.
• Fixed max() returning null or erroring when the first array element is falsy, e.g. max([0, 1]).
• Fixed sum() and join() to return 0 and an empty string respectively for empty arrays.
• Fixed 0.0 to be truthy in filters and logical operators, like every other number.
• Fixed the compiled runtime to apply JMESPath truthiness to || and &&.
• Fixed @(foo), foo[-] and oversized index literals to throw syntax errors.
• Fixed PHP warnings emitted while parsing certain invalid expressions.
• Fixed the caret position in syntax error messages for errors at the end of an expression.
• Fixed map() to error on non-array second arguments instead of returning [].
• Fixed Env::cleanCompileDir() when JP_PHP_COMPILE=on.

Changelog

Sourced from mtdowling/jmespath.php's changelog.

2.9.2 - 2026-07-06

• Pass explicit trim characters ahead of the PHP 8.6 trim default change.

2.9.1 - 2026-06-11

• Fixed the compiled runtime to emit function names as string literals, preventing arbitrary code execution.
• Fixed the parser to reject non-identifier function callees, such as literal and raw string callees.

2.9.0 - 2026-06-10

• Added PHP 8.5 support.
• Fixed to_number() to parse number strings using the JSON number grammar.
• Fixed reverse() and string slicing to operate on UTF-8 characters rather than bytes.
• Fixed slicing of array-like (ArrayAccess + Countable) values.
• Fixed equality and contains() to use JSON semantics, e.g. 1 == 1.0 is now true.
• Fixed multi-select hashes to end projections, so following tokens apply to the projected list.
• Fixed sort() and sort_by() to compare numbers numerically.
• Changed sort(), sort_by(), max(), min(), max_by() and min_by() to order strings by code point.
• Fixed max_by() and min_by() to error on mixed-type keys instead of returning arbitrary elements.
• Fixed max() returning null or erroring when the first array element is falsy, e.g. max([0, 1]).
• Fixed sum() and join() to return 0 and an empty string respectively for empty arrays.
• Fixed 0.0 to be truthy in filters and logical operators, like every other number.
• Fixed the compiled runtime to apply JMESPath truthiness to || and &&.
• Fixed @(foo), foo[-] and oversized index literals to throw syntax errors.
• Fixed PHP warnings emitted while parsing certain invalid expressions.
• Fixed the caret position in syntax error messages for errors at the end of an expression.
• Fixed map() to error on non-array second arguments instead of returning [].
• Fixed Env::cleanCompileDir() when JP_PHP_COMPILE=on.

Commits

• 2157c5e Release 2.9.2
• aa13a7b Freeze trim characters ahead of PHP 8.6 (#121)
• 9c208ba Release 2.9.1
• 83a51c1 Add security policy and convert readme to markdown (#117)
• 69aea5a Fix arbitrary code execution in the compiled runtime (#119)
• 77105da Replace old links in the code (#118)
• 9501100 Release 2.9.0
• ca10035 Fixed sum() and join() to return 0 and an empty string respectively for empty...
• eb36591 Fixed 0.0 to be truthy in filters and logical operators, like every other num...
• eed8676 Fixed multi-select hashes to end projections, so following tokens apply to th...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.